1+ $ErrorActionPreference = ' Stop'
2+ Import-Module vm.common - Force - DisableNameChecking
3+
4+ try {
5+ # set configurations
6+ $toolName = ' suricata'
7+ $category = VM- Get-Category ($MyInvocation.MyCommand.Definition )
8+ $toolDir = Join-Path ${Env: ProgramFiles} $toolName
9+ $executablePath = Join-Path $toolDir " $toolName .exe"
10+ $exeUrl = " https://www.openinfosecfoundation.org/download/windows/Suricata-7.0.10-1-64bit.msi"
11+ $sha256 = " b32a6ca8a793a603a23de307c83831c874099f50bbcd2710ee8325d69a49fb44"
12+
13+ $packageArgs = @ {
14+ toolName = $toolName
15+ category = $category
16+ filetype = " MSI"
17+ silentArgs = " /qn /norestart"
18+ executablePath = $executablePath
19+ url = $exeUrl
20+ sha256 = $sha256
21+ consoleApp = $true
22+ }
23+
24+ VM- Install-With - Installer @packageArgs
25+
26+ # delete default desktop shortcut
27+ $desktopShortcutPath = " ${Env: HomeDrive} \Users\*\Desktop\$toolName *.lnk"
28+ Remove-Item - Path $desktopShortcutPath - ErrorAction SilentlyContinue
29+
30+ # rules configuration and download
31+ $rulesXmlPath = " $ ( Split-Path - parent $MyInvocation.MyCommand.Definition ) /rules.xml"
32+ $rulesXml = [xml ](Get-Content $rulesXmlPath )
33+ $rulesDir = Join-Path $toolDir " rules" - Resolve
34+ $rules = $rulesXml.rules.rule
35+
36+ # tempdir for rules been added
37+ # rules are added to tempdir before been added to default rule folder as other default rules exist in default folder
38+ # rules filenames are needed for adding to config files
39+ $tempToolDir = Join-Path ${Env: TEMP} " $toolName .vm"
40+ $tempRuleDir = Join-Path $tempToolDir " rules"
41+
42+ foreach ($rule in $rules ) {
43+ VM- Write-Log " INFO" " Attempting to install rule: $ ( $rule.name ) "
44+ $filePath = Join-Path $tempToolDir ([System.IO.Path ]::GetFileName($rule.url ))
45+
46+ # create rule specific temp folder
47+ $tempRuleSpecificFolder = Join-Path $tempRuleDir $rule.name
48+ if (-not (Test-Path - Path $tempRuleSpecificFolder )) {
49+ New-Item - Path $tempRuleSpecificFolder - ItemType Directory
50+ }
51+ try {
52+ Invoke-WebRequest - Uri $rule.url - OutFile $filePath - ErrorAction Stop
53+
54+ # If the rule url is of a zip archive (collection of multiple rule files)
55+ if ($filePath -like ' *.zip'
56+ VM- Write-Log " INFO" " ZIP file detected."
57+ Get-ChocolateyUnzip - FileFullPath $filePath - Destination $tempRuleSpecificFolder | Out-Null
58+
59+ # if the rule url is for only one rules file
60+ } elseif ($filePath -like ' *.rules'
61+ VM- Write-Log " INFO" " Rules file detected. Moving to $tempRuleSpecificFolder ..."
62+ Move-Item - Path $filePath - Destination $tempRuleSpecificFolder
63+
64+ # any other types of url resource is unsupported
65+ } else {
66+ throw " Unsupported file type: '$filePath '. Only .zip and .rule are allowed."
67+ }
68+ } catch {
69+ VM- Write-Log " WARN" " Failed rule: $filePath . Cause: $ ( $_.Exception.Message ) "
70+ }
71+ }
72+
73+ $allRuleFiles = Get-ChildItem - Path $tempRuleDir - Recurse - File - Filter * .rules
74+
75+ $rulesConfigPath = Join-Path $toolDir " suricata.yaml" - Resolve
76+ $rulesConfig = Get-Content - Path $rulesConfigPath
77+
78+ # collect the list of all existent rules
79+ $rulesList = $rulesConfig -split " `n " | Where-Object { $_.Trim () -match ' \.rules$' | ForEach-Object { $_.TrimStart (' -'
80+
81+ # index of the location in the yaml where `rule-files:` is specified
82+ $ruleFilesIndex = $null
83+ for ($i = 0 ; $i -lt $rulesConfig.Count ; $i ++ ) {
84+ if ($rulesConfig [$i ] -match ' ^rule-files:$'
85+ $ruleFilesIndex = $i
86+ break
87+ }
88+ }
89+ # If `rule-files:` was not found, throw an error
90+ if ($ruleFilesIndex -eq $null ) {
91+ throw " Line with 'rule-files:' string not found in the config file."
92+ }
93+
94+ # move all rule files in temp rule folder to the suricata rule folder
95+ # add rules to `suricata.yaml`
96+ VM- Write-Log " INFO" " Moving rule-files to $rulesDir ..."
97+ foreach ($ruleFile in $allRuleFiles ){
98+ Move-Item - Path $ruleFile.FullName - Destination $rulesDir - Force
99+ if (-not ($rulesList -contains $ruleFile.Name )){
100+ $newRuleLine = " - $ ( $ruleFile.Name ) "
101+ $rulesConfig =
102+ $rulesConfig [0 .. $ruleFilesIndex ] + # lines to `rule-files:` line
103+ $newRuleLine + # new rule line
104+ $rulesConfig [($ruleFilesIndex + 1 ).. ($rulesConfig.Length - 1 )] # lines after `rule-files:` line
105+ VM- Write-Log " INFO" " [+] Rule-file $ ( $ruleFile.Name ) added to $rulesDir . Added rule-file reference to config file."
106+ }
107+ else {
108+ VM- Write-Log " INFO" " [+] Rule-file $ ( $ruleFile.Name ) added to $rulesDir . Rule-file reference already exist in config file."
109+ }
110+ }
111+
112+ # Save the updated content back to the file
113+ $rulesConfig | Set-Content - Path $rulesConfigPath
114+ }
115+ catch {
116+ VM- Write-Log - Exception $_
117+ }
0 commit comments